OpenStack实践系列②认证服务Keystone

OpenStack实践系列②认证服务Keystone

三、实战OpenStack之控制节点
3.1 CentOS7的时间同步服务器chrony

下载chrony

# yum install -y chrony

修改其配置文件

# vim /etc/chrony.conf
allow 192.168/

chrony开机自启动，并且启动

# systemctl enable chronyd.service
# systemctl start chronyd.service

设置Centos7的时区为Asia/Shanghai

# timedatectl set-timezone Asia/Shanghai

查看时区和时间

# timedatectl status
Local time: Tue -- :: CST
Universal time: Tue -- :: UTC
RTC time: Tue -- ::
Time zone: Asia/Shanghai (CST, +)
NTP enabled: yes
NTP synchronized: no
RTC in local TZ: no
DST active: n/a

# date
Tue Apr  :: CST 

3.2 配置mysql

Openstack的所有组件除了Horizon，都要用到数据库，本文使用的是MariaDB
拷贝配置文件

# cp /usr/share/mariadb/my-medium.cnf /etc/my.cnf
cp: overwrite ‘/etc/my.cnf’? y

# vim /etc/my.cnf（在mysqld模块下添加如下内容）

[mysqld]
default-storage-engine = innodb # 默认的存储引擎
innodb_file_per_table # 使用独享的表空间
collation-server = utf8_general_ci # 设置校对标准
init-connect = 'SET NAMES utf8' # 设置连接的字符集
character-set-server = utf8 # 设置创建数据库时默认的字符集

开机自启和启动mysql

# systemctl enable mariadb.service
Created symlink from /etc/systemd/system/multi-user.target.wants/mariadb.service to /usr/lib/systemd/system/mariadb.service.
[root@node1 ~]# systemctl start mariadb.service
[root@node1 ~]# systemctl status mariadb.service
● mariadb.service - MariaDB 10.1 database server
Loaded: loaded (/usr/lib/systemd/system/mariadb.service; enabled; vendor preset: disabled)
Active: active (running) since Tue -- :: CST; 10s ago
Process:  ExecStartPost=/usr/libexec/mysql-check-upgrade (code=exited, status=/SUCCESS)
Process:  ExecStartPre=/usr/libexec/mysql-prepare-db-dir %n (code=exited, status=/SUCCESS)
Process:  ExecStartPre=/usr/libexec/mysql-check-socket (code=exited, status=/SUCCESS)
Main PID:  (mysqld)
Status: "Taking your SQL requests now..."
CGroup: /system.slice/mariadb.service
└─ /usr/libexec/mysqld --basedir=/usr

Apr  :: node1.chinasoft.com mysql-prepare-db-dir[]: '/usr/bin/mysql_secure_installation'
Apr  :: node1.chinasoft.com mysql-prepare-db-dir[]: which will also give you the option of removing the test
Apr  :: node1.chinasoft.com mysql-prepare-db-dir[]: databases and anonymous user created by default. This is
Apr  :: node1.chinasoft.com mysql-prepare-db-dir[]: strongly recommended for production servers.
Apr  :: node1.chinasoft.com mysql-prepare-db-dir[]: See the MariaDB Knowledgebase at http://mariadb.com/kb or the
Apr  :: node1.chinasoft.com mysql-prepare-db-dir[]: MySQL manual for more instructions.
Apr  :: node1.chinasoft.com mysql-prepare-db-dir[]: Please report any problems at http://mariadb.org/jira
Apr  :: node1.chinasoft.com mysql-prepare-db-dir[]: The latest information about MariaDB is available at http://mariadb.org/.
Apr  :: node1.chinasoft.com mysqld[]: -- ::  [Note] /usr/libexec/mysqld (mysqld 10.1.-MariaDB) starting as process  ...
Apr  :: node1.chinasoft.com systemd[]: Started MariaDB 10.1 database server.
Hint: Some lines were ellipsized, use -l to show in full.

设置mysql密码，关闭匿名用户，删除测试数据库

[root@node1 ~]# mysql_secure_installation

创建所有组件的库并授权(生产环境建议配置复杂密码)

# mysql -uroot -proot
执行sql

CREATE DATABASE keystone;
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'keystone';
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone';
CREATE DATABASE glance;
GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'localhost' IDENTIFIED BY 'glance';
GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'%' IDENTIFIED BY 'glance';
CREATE DATABASE nova;
GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'localhost' IDENTIFIED BY 'nova';
GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'%' IDENTIFIED BY 'nova';
CREATE DATABASE neutron;
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'neutron';
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY 'neutron';
CREATE DATABASE cinder;
GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'localhost' IDENTIFIED BY 'cinder';
GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'%' IDENTIFIED BY 'cinder';

MariaDB [mysql]> show databases;
+--------------------+
| Database |
+--------------------+
| cinder |
| glance |
| information_schema |
| keystone |
| mysql |
| neutron |
| nova |
| performance_schema |
+--------------------+
 rows in set (0.00 sec)

3.3 Rabbit消息队列

　　SOA架构：面向服务的体系结构是一个组件模型，它将应用程序的不同功能单元（称为服务）通过这些服务之间定义良好的接口和契约联系起来。接口是采用中立的方式进行定义的，它应该独立于实现服务的硬件平台、操作系统和编程语言。这使得构建在各种各样的系统中的服务可以使用一种统一和通用的方式进行交互。
在这里Openstack采用了SOA架构方案，结合了SOA架构的松耦合特点，单独组件单独部署，每个组件之间可能互为消费者和提供者，通过消息队列（openstack 支持Rabbitmq，Zeromq，Qpid）进行通信，保证了当某个服务当掉的情况，不至于其他都当掉。

启动Rabbitmq

[root@node1 ~]# systemctl enable rabbitmq-server.service
Created symlink from /etc/systemd/system/multi-user.target.wants/rabbitmq-server.service to /usr/lib/systemd/system/rabbitmq-server.service.
[root@node1 ~]# systemctl start rabbitmq-server.service

新建Rabbitmq用户并授权

[root@node1 ~]# rabbitmqctl add_user openstack openstack
Creating user "openstack" ...
[root@node1 ~]# rabbitmqctl set_permissions openstack ".*" ".*" ".*"
Setting permissions for user "openstack" in vhost "/" ...

启用Rabbitmq的web管理插件

[root@node1 ~]# rabbitmq-plugins enable rabbitmq_management

重启Rabbitmq

[root@node1 ~]# systemctl restart rabbitmq-server.service

查看Rabbit的端口，其中5672是服务端口，15672是web管理端口，25672是做集群的端口

[root@node1 ~]# netstat -lntup|grep
tcp   0.0.0.0: 0.0.0.0:* LISTEN /beam.smp
tcp   0.0.0.0: 0.0.0.0:* LISTEN /beam.smp
tcp6   ::: :::* LISTEN /beam.smp

在web界面添加openstack用户，设置权限，首次登陆必须使用账号和密码必须都是guest
http://192.168.3.199:15672/

role设置为administrator，并设置openstack的密码

3.4 Keystone组件

修改keystone的配置文件用作无用户时，创建用户来链接，此内容使用openssl随机产生

# openssl rand -hex
4ab82b3da89d10c47243bd54487d2d

# vim /etc/keystone/keystone.conf
admin_token = 4ab82b3da89d10c47243bd54487d2d

connection = mysql://keystone:keystone@192.168.3.199/keystone # [database] 部分 用作链接数据库，三个keysthone分别为keystone组件，keystone用户名，mysql中的keysthone库名

切换到keystone用户，导入keystoe数据库

# su -s /bin/sh -c "keystone-manage db_sync" keystone

检查数据库导入结果

MariaDB [keystone]> show tables;
+------------------------+
| Tables_in_keystone |
+------------------------+
| access_token |
| assignment |
| config_register |
| consumer |
| credential |
| domain |
| endpoint |
| endpoint_group |
| federation_protocol |
| group |
| id_mapping |
| identity_provider |
| idp_remote_ids |
| mapping |
| migrate_version |
| policy |
| policy_association |
| project |
| project_endpoint |
| project_endpoint_group |
| region |
| request_token |
| revocation_event |
| role |
| sensitive_config |
| service |
| service_provider |
| token |
| trust |
| trust_role |
| user |
| user_group_membership |
| whitelisted_config |
+------------------------+
 rows in set (0.00 sec)

# cd /var/log/keystone/
# ll
total 8
-rw-r--r-- 1 keystone keystone 7064 Apr 25 16:17 keystone.log（通过切换到keystone用户下导入数据库，当启动的时候回把日志写入到该日志中，如果使用root执行倒库操作，则无法通过keysthone启动keystone程序）

继续修改/etc/keystone/keystone.conf配置

# vim /etc/keystone/keystone.conf

verbose = true # 开启debug模式
servers = 127.0.0.1: # [memcache]部分 更改servers标签，填写memcache地址
driver = sql # [revoke] 部分 开启默认sql驱动
provider = uuid # [token] 部分 开启并使用唯一识别码
driver = memcache # [token] 部分 (使用用户密码生成token时，存储到memcache中，高性能提供服务)

查看更改结果

# grep -n "^[a-Z]" /etc/keystone/keystone.conf
:admin_token = 4ab82b3da89d10c47243bd54487d2d
:verbose = true
:connection = mysql://keystone:keystone@192.168.3.199/keystone
:servers = 127.0.0.1:
:driver = sql
:provider = uuid
:driver = memcache

注意：
memcache配置
很多教程配置都是直接绑定在eth0上，默认安装memcache以后只监听在127.0.0.1上，一定要注意，否则后面keystone认证的时候会报错(大坑)
servers = 192.168.3.199:11211
配置可以用telnet 192.168.3.199 11211验证被拒绝

修改Memcached配置

# cat /etc/sysconfig/memcached
PORT=""
USER="memcached"
MAXCONN=""
CACHESIZE=""
OPTIONS="-l 0.0.0.0,::1" # 改为0.0.0.0这样就监听在了所有网卡上

添加一个apache的wsgi-keystone配置文件，其中5000端口是提供该服务的，35357是为admin提供管理用的
[root@node1 keystone]# vim /etc/httpd/conf.d/wsgi-keystone.conf

Listen
Listen
<VirtualHost *:>
    WSGIDaemonProcess keystone-public processes= threads= user=keystone group=keystone display-name=%{GROUP}
    WSGIProcessGroup keystone-public
    WSGIScriptAlias / /usr/bin/keystone-wsgi-public
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
    <IfVersion >= 2.4>
      ErrorLogFormat "%{cu}t %M"
    </IfVersion>
    ErrorLog /var/log/httpd/keystone-error.log
    CustomLog /var/log/httpd/keystone-access.log combined
    <Directory /usr/bin>
        <IfVersion >= 2.4>
            Require all granted
        </IfVersion>
        <IfVersion < 2.4>
            Order allow,deny
            Allow from all
        </IfVersion>
    </Directory>
</VirtualHost>
<VirtualHost *:>
    WSGIDaemonProcess keystone-admin processes= threads= user=keystone group=keystone display-name=%{GROUP}
    WSGIProcessGroup keystone-admin
    WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
    <IfVersion >= 2.4>
      ErrorLogFormat "%{cu}t %M"
    </IfVersion>
    ErrorLog /var/log/httpd/keystone-error.log
    CustomLog /var/log/httpd/keystone-access.log combined
    <Directory /usr/bin>
        <IfVersion >= 2.4>
            Require all granted
        </IfVersion>
        <IfVersion < 2.4>
            Order allow,deny
            Allow from all
        </IfVersion>
    </Directory>
</VirtualHost>

配置apache的servername,如果不配置servername，会影响keystone服务

[root@node1 keystone]# vim /etc/httpd/conf/httpd.conf
ServerName 192.168.3.199:

启动memcached，httpd，keystone

[root@node1 keystone]# systemctl enable memcached httpd
Created symlink from /etc/systemd/system/multi-user.target.wants/memcached.service to /usr/lib/systemd/system/memcached.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
[root@node1 keystone]# systemctl start memcached httpd

修改默认的memcached监听地址127.0.0.1为0.0.0.0

[root@node1 ~]# cat /etc/sysconfig/memcached
PORT=""
USER="memcached"
MAXCONN=""
CACHESIZE=""
OPTIONS="-l 0.0.0.0,::1"

查看httpd占用端口情况

[root@node1 keystone]# netstat -lntup|grep httpd
tcp6   ::: :::* LISTEN /httpd
tcp6   ::: :::* LISTEN /httpd
tcp6   ::: :::* LISTEN /httpd

创建用户并连接keystone，在这里可以使用两种方式，通过keystone –help后家参数的方式，或者使用环境变量env的方式，下面就将使用环境变量的方式,分别设置了token，API及控制版本（SOA中很适用）

[root@node1 keystone]# export OS_TOKEN=4ab82b3da89d10c47243bd54487d2d
[root@node1 keystone]# export OS_URL=http://192.168.3.199:35357/v3
[root@node1 keystone]# export OS_IDENTITY_API_VERSION=

创建admin项目（project）

[root@node1 keystone]# openstack project create --domain default --description "Admin Project" admin
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Admin Project |
| domain_id | default |
| enabled | True |
| id | ddbd3b664df640fb842f791c1c852f8a |
| is_domain | False |
| name | admin |
| parent_id | None |
+-------------+----------------------------------+

创建admin用户（user）并设置密码（生产环境建议设置复杂密码）

[root@node1 keystone]# openstack user create --domain default --password-prompt admin
User Password:
Repeat User Password:
+-----------+----------------------------------+
| Field | Value |
+-----------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | 0d0e11a89eec4b9f9812491f967bfc29 |
| name | admin |
+-----------+----------------------------------+

创建admin的角色（role）

[root@node1 keystone]# openstack role create admin
+-------+----------------------------------+
| Field | Value |
+-------+----------------------------------+
| id | e07056a7929640eea958d01519d16de4 |
| name | admin |
+-------+----------------------------------+

把admin用户加到admin项目，赋予admin角色，把角色，项目，用户关联起来

[root@node1 keystone]# openstack role add --project admin --user admin admin

创建一个普通用户demo,demo项目，角色为普通用户（uesr），并把它们关联起来

[root@node1 keystone]# openstack project create --domain default --description "Demo Project" demo
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Demo Project |
| domain_id | default |
| enabled | True |
| id | 019eaae6f6c049658da8d7c6776201d7 |
| is_domain | False |
| name | demo |
| parent_id | None |
+-------------+----------------------------------+

配置密码也为demo

[root@node1 keystone]# openstack user create --domain default --password=demo demo
+-----------+----------------------------------+
| Field | Value |
+-----------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | 09e4d0b4d57c45e29cea321d1f620de3 |
| name | demo |
+-----------+----------------------------------+

[root@node1 keystone]# openstack role create user
+-------+----------------------------------+
| Field | Value |
+-------+----------------------------------+
| id | 12d9c22c247149e79af8c28e2ef1066c |
| name | user |
+-------+----------------------------------+

[root@node1 keystone]# openstack role add --project demo --user demo user

创建一个service的项目，此服务用来管理nova，neuturn，glance等组件的服务

[root@node1 keystone]# openstack project create --domain default --description "Service Project" service
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Service Project |
| domain_id | default |
| enabled | True |
| id | 7721ff49147445ad8bbc87a3e37534ec |
| is_domain | False |
| name | service |
| parent_id | None |
+-------------+----------------------------------+
查看创建的用户,角色，项目

[root@node1 keystone]# openstack user list
+----------------------------------+-------+
| ID | Name |
+----------------------------------+-------+
| 09e4d0b4d57c45e29cea321d1f620de3 | demo |
| 0d0e11a89eec4b9f9812491f967bfc29 | admin |
+----------------------------------+-------+
[root@node1 keystone]# openstack project list
+----------------------------------+---------+
| ID | Name |
+----------------------------------+---------+
| 019eaae6f6c049658da8d7c6776201d7 | demo |
| 7721ff49147445ad8bbc87a3e37534ec | service |
| ddbd3b664df640fb842f791c1c852f8a | admin |
+----------------------------------+---------+
[root@node1 keystone]# openstack role list
+----------------------------------+-------+
| ID | Name |
+----------------------------------+-------+
| 12d9c22c247149e79af8c28e2ef1066c | user |
| e07056a7929640eea958d01519d16de4 | admin |
+----------------------------------+-------+

注册keystone服务，虽然keystone本身是搞注册的，但是自己也需要注册服务
创建keystone认证

[root@node1 keystone]# openstack service create --name keystone --description "OpenStack Identity" identity
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Identity |
| enabled | True |
| id | 826594136e754665bc7c2ffd61e5c60d |
| name | keystone |
| type | identity |
+-------------+----------------------------------+

分别创建三种类型的endpoint,分别为public:对外可见，internal内部使用，admin管理使用

[root@node1 keystone]# openstack endpoint create --region RegionOne identity public http://192.168.3.199:5000/v2.0
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 1cd6d3b8cb55480eb830722cb8032b04 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 826594136e754665bc7c2ffd61e5c60d |
| service_name | keystone |
| service_type | identity |
| url | http://192.168.3.199:5000/v2.0 |
+--------------+----------------------------------+

[root@node1 keystone]# openstack endpoint create --region RegionOne identity internal http://192.168.3.199:5000/v2.0
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | fe67f7ff5f5344f0aa24079fcd7e9999 |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 826594136e754665bc7c2ffd61e5c60d |
| service_name | keystone |
| service_type | identity |
| url | http://192.168.3.199:5000/v2.0 |
+--------------+----------------------------------+

[root@node1 keystone]# openstack endpoint create --region RegionOne identity admin http://192.168.3.199:35357/v2.0
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 803bfebdac67435180a0fa0a6df6acba |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 826594136e754665bc7c2ffd61e5c60d |
| service_name | keystone |
| service_type | identity |
| url | http://192.168.3.199:35357/v2.0 |
+--------------+----------------------------------+

查看创建的endpoint

[root@node1 keystone]# openstack endpoint list
+----------------------------------+-----------+--------------+--------------+---------+-----------+---------------------------------+
| ID | Region | Service Name | Service Type | Enabled | Interface | URL |
+----------------------------------+-----------+--------------+--------------+---------+-----------+---------------------------------+
| 1cd6d3b8cb55480eb830722cb8032b04 | RegionOne | keystone | identity | True | public | http://192.168.3.199:5000/v2.0 |
| 803bfebdac67435180a0fa0a6df6acba | RegionOne | keystone | identity | True | admin | http://192.168.3.199:35357/v2.0 |
| fe67f7ff5f5344f0aa24079fcd7e9999 | RegionOne | keystone | identity | True | internal | http://192.168.3.199:5000/v2.0 |
+----------------------------------+-----------+--------------+--------------+---------+-----------+---------------------------------+

链接到keystone，请求token，在这里由于已经添加了用户名和密码，就不再使用token，所有就一定要取消环境变量了

[root@node1 ~]# unset OS_TOKEN
[root@node1 ~]# unset OS_URL
[root@node1 ~]# openstack --os-auth-url http://192.168.3.199:35357/v3 --os-project-domain-id default --os-user-domain-id default --os-project-name admin --os-username admin --os-auth-type password token issue
Password:
+------------+----------------------------------+
| Field | Value |
+------------+----------------------------------+
| expires | --25T12::.648250Z |
| id | b63b05cb3a6d4c438a072d501ad64355 |
| project_id | 7340dd86a8b14e73ac36b6d6385c689c |
| user_id | 4e857cca196e44d6994a3bee058a0274 |
+------------+----------------------------------+

报错记录：
[root@node1 keystone]# openstack --os-auth-url http://192.168.3.199:35357/v3 --os-project-domain-id default --os-user-domain-id default --os-project-name admin --os-username admin --os-auth-type password token issue
An unexpected error prevented the server from fulfilling your request. (HTTP 500) (Request-ID: req-1d330a83-ab77-4e0f-8e42-1c8d461aea3b)

通过看日志也没看出啥(/var/log/httpd/keystone-access.log keystone-error.log)，其实是memcached监听的IP需要由192.168.3.199改为127.0.0.1
下面的报错可以忽略
2017-04-25 19:05:40.954308 No handlers could be found for logger "oslo_config.cfg"

创建OpenStack的客户端环境的脚本

配置admin和demo用户的环境变量，并添加执行权限，以后执行命令,直接source一下就行了

[root@linux-node1 ~]# cat admin-openrc.sh
export OS_PROJECT_DOMAIN_ID=default
export OS_USER_DOMAIN_ID=default
export OS_PROJECT_NAME=admin
export OS_TENANT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_AUTH_URL=http://192.168.3.199:35357/v3
export OS_IDENTITY_API_VERSION=

[root@linux-node1 ~]# cat demo-openrc.sh
export OS_PROJECT_DOMAIN_ID=default
export OS_USER_DOMAIN_ID=default
export OS_PROJECT_NAME=demo
export OS_TENANT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=demo
export OS_AUTH_URL=http://192.168.3.199:5000/v3
export OS_IDENTITY_API_VERSION=

[root@node1 ~]# chmod +x demo-openrc.sh
[root@node1 ~]# chmod +x admin-openrc.sh
[root@node1 ~]# source admin-openrc.sh

[root@node1 ~]# openstack token issue
+------------+----------------------------------+
| Field | Value |
+------------+----------------------------------+
| expires | --25T12::.242121Z |
| id | c0d9510f39034b779479af4a91f8f3b2 |
| project_id | 7340dd86a8b14e73ac36b6d6385c689c |
| user_id | 4e857cca196e44d6994a3bee058a0274 |
+------------+----------------------------------+